WAFs! WAFs! We don't need no Stinkin' WAFs! Extending WAFs at the Application Layer
summary
Claim: an application-layer sanitizer called san juan catches what network WAFs miss by validating inputs before app code runs. Implementation details: Java only, deployable as a servlet filter or interceptor, regexes compiled and cached at startup, supports nine data types, per-shield shields and data types with min/max length to avoid regex DoS, optional tracking id and JSON error payloads, example servlet and logs, source at github.com/bernardo1024/sandwell. It explicitly does not replace WAFs and advertises zero runtime dependencies.
AI-written summary · about
chapters (33)
- 0:00Intro
- 1:06Brief History of WAF's
- 2:46Purpose of WAF's
- 3:15Problems with WAF's
- 5:29Bypassing WAF'S
- 6:36Sanwaf: Application-Level Security Control
- 7:32Purpose of Sanwaf
- 8:01Bypass Example A cookie is being blocked by a WWF and is causing an issue, so
- 8:55Sanwaf Does Not Replace WAF's
- 9:36Sanitizing Data
- 10:18How Sanwaf Works
- 11:21Sanwaf Structure
- 11:38Global Settings
- 12:38Shield Settings
- 13:51Regex Settings
- 14:36Metadata Settings
- 15:46Sanwaf Datatypes
- 18:49Sanwaf: How it works
- 20:12Sanwaf: How Strings Work
- 21:02Sanwaf Datatype Performance
- 23:53Example - Delimited Set of Numbers
- 25:18Datatype Example: Delimited Set of Numbers (RegEx)
- 26:59Datatype Example: Alphanumeric and Whitelisted
- 27:33Datatype Example: Using a lava Class
- 28:39Datatype Example: String & Regex
- 30:00Implementing Sanwaf
- 31:01Sample Implementation: Filter
- 31:59Sample Implementation: Logging
- 33:05Error Message Example
- 34:59Rending Error to End User
- 35:43Sample Application
- 36:23Where to Git Sanwaf
- 37:07Contact Information
related talks
42mDon’t use a WAF, and when you should, anyway.
40mWAF Made Easy
38mWeb Application Firewalls Revisited
27mSecuring Applications and Managing WAFs at a large scale
40mWeb Application Firewalls: Analysis of Detection Logic
14mWeb Application Firewalls: A False Sense of Security?
21mWAF Wars - The art of blocking attacks while having a coffee
46mIt is rough without a WAF